Witness: first guess

diff --git a/epan/dissectors/Makefile.common b/epan/dissectors/Makefile.common
index 9ca58976edd86356cf40447024b74ca3fb051c59..d38c7076a848c2fe41474213a611e5eb9a3439b9 100644 (file)
--- a/epan/dissectors/Makefile.common
+++ b/epan/dissectors/Makefile.common
@@ -1283,7 +1283,8 @@ DISSECTOR_SRC = \
 # Files that create warnings while building
 #
 DIRTY_DISSECTOR_SRC = \
-       packet-x11.c
+       packet-x11.c \
+       packet-dcerpc-witness.c
 
 #
 # Headers for file dissectors.

diff --git a/epan/dissectors/pidl/witness.cnf b/epan/dissectors/pidl/witness.cnf
new file mode 100644 (file)
index 0000000..5295d6a
--- /dev/null
+++ b/epan/dissectors/pidl/witness.cnf
@@ -0,0 +1,6 @@
+MANUAL witness_dissect_element_interfaceInfo_group_name
+TYPE ipv4address "offset=PIDL_dissect_uint32(tvb, offset, pinfo, tree, drep, @HF@, @PARAM@);" FT_BYTES BASE_NONE 0 NULL 4
+TYPE ipv6address "offset += 16;" FT_NONE BASE_NONE 0 NULL 2
+HF_FIELD hf_witness_witness_interfaceInfo_group_name "Group Name" "witness.witness_interfaceInfo.group_name" FT_STRING BASE_NONE NULL 0 "" "" ""
+CODE START
+CODE END

diff --git a/epan/dissectors/pidl/witness.idl b/epan/dissectors/pidl/witness.idl
new file mode 100644 (file)
index 0000000..165d66e
--- /dev/null
+++ b/epan/dissectors/pidl/witness.idl
@@ -0,0 +1,68 @@
+#include "idl_types.h"
+
+import "misc.idl";
+
+[
+  uuid("ccd8c074-d0e5-4a40-92b4-d074faa6ba28"),
+  version(1.1),
+  pointer_default(unique),
+  helpstring("SMB Witness Service"),
+  endpoint("ncacn_ip_tcp:")
+]
+interface witness
+{
+       /*****************/
+       /* Function 0x00 */
+
+       typedef struct {
+               [charset(UTF16),to_null] uint16 group_name[260];
+               uint32 version;
+               uint16 state;
+               [flag(NDR_BIG_ENDIAN)] ipv4address ipv4;
+               [flag(NDR_BIG_ENDIAN)] ipv6address ipv6;
+               uint32 flags;
+       } witness_interfaceInfo;
+
+       typedef struct {
+               uint32 num_interfaces;
+               [size_is(num_interfaces)] witness_interfaceInfo *interfaces;
+       } witness_interfaceList;
+
+       WERROR witness_GetInterfaceList(
+               //[in,flag(NDR_REMAINING)] DATA_BLOB in_blob,
+               [out] witness_interfaceList **interface_list
+               );
+
+       /*****************/
+       /* Function 0x01 */
+
+       WERROR witness_Register(
+               [out,ref] policy_handle *context_handle,
+               [in] uint32 version,
+               [in,unique,string,charset(UTF16)] uint16 *net_name,
+               [in,unique,string,charset(UTF16)] uint16 *ip_address,
+               [in,unique,string,charset(UTF16)] uint16 *client_computer_name
+               );
+
+       /*****************/
+       /* Function 0x02 */
+
+       WERROR witness_UnRegister(
+               [in] policy_handle context_handle
+               );
+
+       /*****************/
+       /* Function 0x03 */
+
+       typedef struct {
+               uint32 message_type;
+               uint32 length;
+               uint32 num_messages;
+               [size_is(length)] uint8 *message_buffer;
+       } witness_notifyResponse;
+
+       WERROR witness_AsyncNotify(
+               [in] policy_handle context_handle,
+               [out] witness_notifyResponse **response
+               );
+}